Data Factory | Liebensraum

on https://learn.microsoft.com/en-us/rest/api/power-bi/ I couldn’t (easily) find if Managed Identities are supported when using the PowerBI rest API, especially the ‘asadmin’ parts.

The documentation also doesn’t really show (or I couldn’t find it), for what audience to request a token. Using a Logic App I eventually got it to work after a lot of trial and error 🙂

managed identity auth for powerbi rest api

For those googling this, I encountered a bunch of these first before finding the right audience of ‘https://api.fabric.microsoft.com/.default’

Http request failed as there is an error getting AD OAuth token: ‘AADSTS500011: The resource principal named https://api.fabrik.microsoft.com was not found in the tenant named XXXXX. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You might have sent your authentication request to the wrong tenant.

Http request failed as there is an error getting AD OAuth token: ‘AADSTS500011: The resource principal named https://api.powerbi.com was not found in the tenant named XXX

Http request failed as there is an error getting AD OAuth token: ‘AADSTS500011: The resource principal named https://analysis.windows.net/powerbi/api/.default was not found in the tenant named XXX

Http request failed as there is an error getting AD OAuth token: ‘AADSTS500011: The resource principal named https://analysis.windows.net was not found in the tenant named XXX

Let’s face it, Microsoft’s documentation on using Sharepoint as a data source (or sink) in ADF is pretty bad. And it doesn’t even describe how to use the Managed Identity of ADF, who still wants to register separate app credentials? Noooooo you don’t.

So here’s an example how to use Managed Identity to read a json file from a given SpO site, using minimal permissions given to ADF.

Enable MI in datafactory, I’m assuming you know how to do this.
Give ADF Sites.Selected Graph permissions, e.g. like this:

Param(
    [Parameter(Mandatory=$true)][String]$displayName="{NAMEOFADFINSTANCE}",
    [Parameter(Mandatory=$true)][String]$role="Sites.Selected"
)
Connect-AzureAD 
$Msi = (Get-AzureADServicePrincipal -Filter "displayName eq '$displayName'")
Start-Sleep -Seconds 10
$baseSPN = Get-AzureADServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"
$AppRole = $baseSPN.AppRoles | Where-Object {$_.Value -eq $role -and $_.AllowedMemberTypes -contains "Application"}
New-AzureAdServiceAppRoleAssignment -ObjectId $Msi.ObjectId -PrincipalId $Msi.ObjectId -ResourceId $baseSPN.ObjectId -Id $AppRole.Id
$Msi.AppId

Go to https://yourtenant.sharepoint.com/sites/yoursite/_api/site/id and copy the Edm Guid:

Go to https://developer.microsoft.com/en-us/graph/graph-explorer. Log in at the top right using a user with sufficient permissions, set the mode to POST, add the EDM guid in the URL and create the request body as follows (the id in the body can be found back in step 2, $Msi.AppId)